The investigative ethos at the heart of counter-terrorism is fairly
simple. Intelligence agencies ask two broad questions: is this person or
group linked to people we already know are terrorists, and does their
visible activity include behavioural precursors that have been reliably
linked to terrorism in the past?

These two questions lie at the heart of both the triaging of new
leads and active investigations. In the case of the latter, agencies
have created 'tripwires' to identify suspicious behaviour, such as
suddenly buying large quantities of fertiliser or making unexpected
plans to travel overseas.

In the current climate, where most agencies have more targets than
investigative capacity, drawing a negative on both of these questions
means an investigation is unlikely to go any further. Yet from what we
know so far about the staggering number of individuals and groups behind
attacks over the past eight weeks and beyond, for some the answers to
these questions would have drawn a blank.

This is in large part due to a shift in terrorism strategy articulated by al Qaeda in their Inspire
magazine in 2010 but brought to life by ISIS: open-source jihad. By
encouraging attacks in which the attacker alone identifies the target,
timing and method, it removed the requirement for pre-attack
coordination with known terrorist entities.

In many ways, the conflict in Syria (while an obvious fillip for
Islamist extremism across the world) delayed the advent of these types
of attack. Why focus domestically when you could travel to Syria and
Iraq instead? But as Western governments began to realise the scale of
what was unfolding in the Middle East, it became more difficult to
travel to those locations. As a consequence, radicalised individuals
unable to leave their own country (such as Numan Haider in 2014 in Melbourne) shifted the target of their violence inwards.

The subsequent media coverage and ISIS's praise for such attackers as
martyrs for their cause have had real consequences. The dual factors of
posthumous media infamy and the pardoning of previous sins has
attracted individuals beyond those connected to known terrorists or with
terrorist-like behaviours, individuals for whom intelligence agencies
would have drawn a blank.

We saw this in Orlando in June. Omar Mateen
was neither meaningfully connected to known extremists or behaving like
one. Based on what we know so far, neither was Nice attacker Mohamed
Bouhel. Instead, analysis has focused on issues of identity, sexuality,
mental health and a violent past (and, in Bouhel's case, on further
evidence of the connection between persistent criminal behaviour and a
subsequent shift towards extremism).

These factors may be useful in understanding which individuals
already under investigation might take extreme and violent actions, but
they are not unique behavioural indicators of use to intelligence
agencies. In a practical sense, any attempt to overlay them on top of
the existing counter-terrorism investigative approach would be
unworkable.

If our understanding of what a terrorist looks like is starting to
shift, so too is the judgment intelligence agencies must make about
whether links to known terrorists are an important factor in deciding
whether an attack is likely to succeed, and how lethal it will be.

This second point has also historically been central to
counter-terrorism strategy. Operational experience and statistics showed
that an attack plot involving returned foreign fighters or instruction
from terrorist groups overseas would be significantly deadlier
than those that did not. While lone actors or self-starters were
certainly a concern, they typically struggled to build explosive devices
or get access to weaponry without contacting known terrorist or
criminal entities.

Unfortunately, isolated actors and their cheerleaders overseas have
realised this too. As Nice, Orlando and potentially Wurzburg all
demonstrate, these unconnected individuals or networks are instead
focusing on softer and typically more local targets. And utilising an
attack methodology that challenges intelligence agency notions of what
behaviour makes an individual 'look like a terrorist'. After all,
possessing a knife or renting a truck is no obvious precursor to a
terrorist attack.

Yet both Nice and Orlando have proved deadlier than many previous
attacks directed by terrorist networks overseas or carried out by
returning foreign fighters. Their tragic impact will not have gone
unnoticed by the rest of the would-be terrorist community.

Terrorist attacks over the past two months have challenged many counter-terrorism pre-conceptions. The Australian Government is right to review existing processes to counter these 'new' threats, and in particular, look at the safety of public events. But attempts to draw a wider net,
and include mental health records, links to criminality and addiction,
are no guarantee of success.

What is certain is that, in the short-term,
there are unlikely to be any easy answers.

wHoA!

h0t!

~hEy Y"all! DoN"t MiSs GsGf~!

Guaranteed to magically transform subscribers into superior intellectuals, worldly, pious, witty, cool, fun to be with, irresistable, au courant and all together with it. Amaze friends, confound enemies and revel in the envy and righteous respect of peers.